Privacy Policy

The data controller

HUBIX INVESTMENT S.A. is a personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, of Romanian Law no. 190/2018 and of the e-Privacy Directive.

Controller details: HUBIX INVESTMENT S.A., with its registered office in Brănești, 66A Horia Street, Ilfov County, Romania, registered with the Trade Register under no. J23/5706/04.09.2023, sole registration code 48727284.

You can send any request regarding the processing of your personal data in writing, with your signature, to Brănești, 66A Horia Street, Ilfov County, Romania, or by email to contact@hubix.ro.

We are GDPR compliant

What does GDPR mean? It stands for the General Data Protection Regulation (679/2016). Your personal data is kept in accordance with the law and with Regulation (EU) 2016/679, referred to in this document as the GDPR, and with Romanian Law no. 190/2018.

HUBIX INVESTMENT S.A. has implemented and complies with the GDPR, processing the personal data collected on this website in a confidential, organised, secure and responsible manner.

HUBIX INVESTMENT S.A. understands the importance of processing data appropriately, so only authorised persons have access to the personal data of data subjects, in line with internally regulated policies and workflows.

To ensure an appropriate level of security, we have implemented adequate technical and organisational measures capable of ensuring the confidentiality and integrity of personal data and of restoring its availability in a timely manner in the event of a physical or technical incident.

To protect personal data, all data storage devices are adequately secured, encryption is used for some operations, and we have a process for regularly testing, assessing and evaluating the effectiveness of our technical and organisational measures to ensure the security of processing.

Terms used

Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Data subject is the person whose personal data is processed.

Recipient means a natural or legal person, public authority, agency or another body to which the personal data is disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients.

Your rights

Right to be informed: you have the right to be informed about the processing and protection of your personal data (Articles 13 and 14 GDPR).

Right of access: you have the right to obtain from the controller confirmation as to whether or not your personal data is being processed, and a copy of it (Article 15 GDPR).

Right to rectification: you have the right to have inaccurate data corrected and incomplete data completed (Article 16 GDPR).

Right to erasure (“right to be forgotten”): you have the right to obtain the erasure of your personal data, where the legal conditions are met (Article 17 GDPR).

Right to restriction of processing: you have the right to obtain, where the legal conditions are met, the marking of stored personal data in order to limit its further processing (Article 18 GDPR).

Right to data portability: you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller, where the legal conditions are met (Article 20 GDPR).

Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data, where the legal conditions are met (Article 21 GDPR).

Right not to be subject to automated individual decision-making: you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). This website makes no such decisions.

Right to withdraw consent: where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7 GDPR).

Right to lodge a complaint or go to court: you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) and to go to court to defend any rights guaranteed by data protection law that have been infringed (Articles 77 and 79 GDPR).

What personal data we process (only what is necessary)

This website has no user accounts and takes no payments. We process personal data only when you contact us, through one of the forms on the website or directly, by email or phone.

Through the website forms (Investors, Developers, Strategic Partner, apartments and contact) we process the data you enter: your full name, company or organisation, email address, phone number and message, plus the information specific to each form:

• investor form: preferred strategy and estimated investment ticket;
• developer form: project location, asset class, estimated gross development value (GDV), estimated total investment cost, capital required, project stage and the project presentation (deck) you upload;
• apartment form: preferred area;
• contact form and Strategic Partner form: the capacity in which you are contacting us and the type of inquiry.

When you submit a form we also keep, as proof of your agreement and to protect the website against abuse: the date and time of submission, the consent text shown, the version of this policy, the page and language from which you submitted the form, your truncated IP address (the last part of the address is removed so that it does not identify you) and your browser type (user agent). To limit the number of submissions, your full IP address is used temporarily, only in the server’s memory, without being saved to the database or to files.

When you contact us directly, by email or phone, we process the data you share with us in that correspondence.

Personal data provided to register a complaint or report will be processed in full in order to resolve it.

HUBIX INVESTMENT S.A. does not store card details or similar banking data.

This website does not use cookies for visitors, nor any traffic analytics tools. For details, see our Cookie Policy.

Why we process personal data

All data is processed for the purposes initially stated and of which you have been informed. We do not further process personal data for purposes incompatible with the original purpose.

Data from the forms and from correspondence is processed in order to:

• respond to your request and stay in touch with you;
• assess the opportunity you propose (the development project, the investment or the collaboration) and take the steps needed before a possible contract;
• protect the website against automated messages and abuse;
• keep proof of your agreement;
• fulfil the legal obligations of HUBIX INVESTMENT S.A. and resolve any complaints.

We do not use form data for marketing campaigns or newsletters. If we ever want to send you such communications, we will first ask for your separate consent.

HUBIX INVESTMENT S.A. does not process any category of personal data for other purposes incompatible with those initially established, and does not process personal data for longer than the period set for that category of data.

Legal basis for processing

• Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR): assessing your request and the proposed opportunity, and communicating with you for this purpose.
• Your consent (Article 6(1)(a) GDPR), given by ticking the agreement box in the form, for processing the data submitted through the form.
• Legitimate interest (Article 6(1)(f) GDPR): website security and protection against abuse, keeping proof of your agreement, defending the rights of HUBIX INVESTMENT S.A. in any complaints or disputes.
• Legal obligation (Article 6(1)(c) GDPR): in the event of inspections by authorities, the reporting, documentation and resolution of security incidents, or requests from authorities or data subjects.

How we process personal data

Your data is processed by collection, recording, organisation, storage and archiving, structuring, consultation, use, retrieval, alteration or rectification, restriction, erasure or destruction, at the request of the data subject where the controller has this legal obligation, or once the period for which it was processed has ended.

Data submitted through the forms is saved in the website database, in the administration area, which only authorised persons within HUBIX INVESTMENT S.A. can access. The project presentation (deck) uploaded through the developer form is kept in a private area accessible only to administrators. For each form submitted, the Hubix team receives an email notification, which may include the deck as an attachment.

Data is disclosed to third parties only in the situations described in “Who we share personal data with”, to persons authorised for this purpose and in accordance with the GDPR.

How long we keep personal data

Data submitted through the forms and through correspondence is processed for as long as necessary to respond to your request and assess the proposed collaboration, but no longer than 3.5 years from our last interaction with you, unless the data is needed on the basis of a legitimate interest or a legal obligation. If we enter into a contract, the data needed to perform it is kept for the duration of the contract and afterwards, in line with the statutory limitation, storage and archiving periods.

Personal data processed on the basis of consent is processed until consent is withdrawn.

Personal data processed on the basis of a legal obligation is processed for as long as the legal obligation applies.

Personal data processed on the basis of legitimate interest is processed for as long as the legitimate interest exists.

For any category of data whose legal basis at some point becomes legitimate interest, the retention period may be extended by decision of the controller for as long as the legitimate interest exists, for example in situations causing harm to HUBIX INVESTMENT S.A., where the data is used as evidence.

Who we share personal data with

As a matter of principle, we do not wish to share data with third parties. However, there are situations in which this is necessary to ensure the continued activity of HUBIX INVESTMENT S.A.

Personal data is processed by processors under a contract that ensures data confidentiality and security measures in line with Articles 28 and 32 GDPR: the website hosting provider, the backup storage provider and the email service provider through which we receive form notifications.

Where applicable, data may be disclosed to public institutions, the police, the Romanian tax authority (ANAF), institutions involved in preventing fraud or money laundering, and any other institutions or authorities with regulatory, supervisory or judicial powers, within the limits of the law.

The website contains links to social networks (for example, LinkedIn). Once you access them, these networks become data controllers and process data on their own behalf.

Personal data is not shared with any third party other than those stated.

We do not address minors

HUBIX INVESTMENT S.A. does not process personal data of minors on this website; the website is not intended for persons under 18. If you know that your child’s data has been provided on the website, you can contact us and we will handle your request in accordance with the law.

Security of online processing

HUBIX INVESTMENT S.A. ensures an adequate level of security for the processing of personal data on this website, in accordance with Regulation (EU) 2016/679 and Romanian Law no. 190/2018. Communication between your browser and the website is encrypted (HTTPS).

HUBIX INVESTMENT S.A. has drawn up security plans to prevent the loss, disclosure, alteration, copying, or accidental or unlawful destruction of data, and to limit unauthorised access to the personal data processed on the website.

Personal data breaches

The controller and its processors are responsible for notifying, assessing and documenting any security incidents and for ensuring measures to prevent any breach that could lead to a security incident, as provided in Article 4(12) and Articles 33–34 GDPR.

Further information

The full Privacy Policy can be consulted at the registered office of HUBIX INVESTMENT S.A. in Brănești, 66A Horia Street, Ilfov County, Romania, or received upon written request. For cookies, see our Cookie Policy; for the agreement in our forms, see our Terms and Conditions.